Be ready for international and national audits every single day.
International and national regulations are part of our product design. Log integrity, legally valid time stamping, long-term archiving, reporting and auditability on a single platform.
National regulations
Retention of internet access records
Internet traffic must be recorded and retained with a time stamp. If an employee or guest shares criminal content over the organization's network and no time-stamped access record exists, liability falls on the organization's authorized signatory.
- Time-stamped archive of access records with OrianaLOG; retention plan of up to 730 days
- Firewall, DNS, DHCP and hotspot logs matched to user and IP
- Daily automatic archiving and integrity verification; evidence within minutes during an audit
Electronic signature and time stamping
Collected logs are time-stamped daily with a TÜBİTAK-approved time stamp under Turkish e-signature law 5070. This proves, as evidence in court and audits, when the records were created and that they have not been altered.
- Time-stamped data archive module; time stamp server configuration
- Integrity through log signing / hash verification
- Create and download archives for custom date ranges
Protection of personal data
Who accessed personal data, when and how must be recorded. If an employee accesses and copies customer data without permission and there is no log record, it cannot be proven; the organization then faces serious fines for violating KVKK (Turkish data protection law).
- User-level record of database, file (File Audit) and application access logs
- Sensitive data masking and encrypted storage
- Cookie consent logging: time-stamped record of Accept / Reject / Change choices
Sector-specific regulations
The BDDK (Turkish banking regulator) Information Systems Regulation for banks and Cybersecurity Law 7545 for critical infrastructure and institutions reshape cybersecurity obligations. Sector regulators such as SPK (capital markets) and EPDK (energy) also impose log management and incident notification requirements.
- In-house R&D; data sovereignty and supply chain security
- TRTEST A-Level (Türkiye) certified SIEM
- Scheduled generation of audit reports
Global standards and directives
With German and French interface support, Oriana helps organizations operating in Europe meet GDPR, NIS2, DORA and BSI/KRITIS requirements.
| Framework | Scope | Log requirement | Oriana support |
|---|---|---|---|
| GDPR | EU personal data protection | Record of access to personal data; proof of who accessed which data | Access logging, UEBA, time-stamped archive, sensitive data masking |
| NIS2 | EU critical infrastructure cybersecurity directive | Incident detection, logging and reporting obligations | Correlation, alerting, fast access to incident history, reporting |
| DORA | EU financial digital operational resilience | Monitoring of security incidents, response and continuity | Incident monitoring, MTTD/MTTR improvement, auditability (contributes) |
| ISO/IEC 27001:2022 | Information security management system | A.8.15 Logging, A.8.16 Monitoring, A.8.17 Clock synchronization | Central logging, monitoring, time standardization via NTP, reports |
| PCI DSS v4.0 | Cardholder data security | Requirement 10: log all access, retain for 1 year | Collection of payment system logs, retention policies, reporting |
| HIPAA | US health data | Retention of patient data access logs | EHR access logging, File Audit, anomaly detection |
| SOX | US financial reporting | Logging of financial systems | Database and application access records |
| NIST SP 800-53 / CSF 2.0 | US security controls | AU (Audit) control family | Audit records, integrity, retention |
| SOC 2 · BSI IT-Grundschutz / KRITIS | Service assurance · German critical infrastructure | Monitoring and logging controls | Reporting and traceability support |
Oriana products provide reporting and traceability capabilities that support your compliance journey with these frameworks; achieving legal compliance depends on the organization's overall processes. Contact our product team for the report template scope of each version.
Ready every day, not just on audit day.
Collect and tag
Logs from all sources are collected centrally; events are tagged with a severity level from 1 to 10.
Stamp and archive
Automatic archiving every night; time stamping under Law 5070; per-device retention periods.
Report
Daily, weekly and monthly compliance reports; PDF/Excel output and e-mail distribution.
Present evidence
On an audit or forensic request, the archive for the relevant date range and its integrity verification within minutes.
How many person-days does audit reporting take you?
Let's review your current processes together and show which reports can be automated.